We first show that the LPIPS distance is more suitable to common image corruptions than the \(\operatorname{\mathbf {\ell }}_2\)  distance. We note that previous works [1]}, [2]} have discussed its advantages over other commonly used distances, however not in the context of corruptions from CIFAR-10-C. Another difference to [1]} is that here we compute the LPIPS distance using full images instead of smaller image patches as we are eventually interested in performing adversarial training using full inputs.
